HTTP IDS Evasions Revisited

Architecture and Background

Daniel Roelker - HTTP IDS Evasions Revisited HTTP IDS Evasions Revisited HTTP IDS evasions have been prevalent ever since the release of RFP's whisker. But what's been happening since? This presentation addresses the advancement in HTTP IDS evasions since whisker. Some of the specific topics covered will be: * The evolution of protocol-based IDS and signature-based IDS in regards to HTTP evasions.

Vulnerability Analysis

What's the same and what's different? * Latest and greatest obfuscations in URL Encoding (what the IDS vendors don't know). We'll go into the various types of URL encodings, how the different types of Unicode encoding really work, and new encoding types and combinations that confuse IDS HTTP decoders. * Evasions using HTTP/1.1 protocol characteristics, in the spirit of Bob Graham's Sidestep program.

Exploitation and Demonstrations

The following source code will be released to demonstrate and automate the various URL encoding methods and HTTP/1.1 protocol evasions tactics: * Source code for automatically generating URL IDS evasions using the tactics discussed in the presentation. * Source code for generating Unicode codepoint values on target IIS machines for further fun with URL obfuscation and evasion. * Source code that profiles web servers for what types of evasions do and do not work against them -- hopefully this can be released. Daniel Roelker is a security researcher and software developer for Sourcefire, Inc in Columbia, MD.

Remediation and Defensive Strategies

His most recent projects include a new HTTP protocol decoder for the Snort IDS (soon to be released) and his work on the Snort 2.0 high-speed detection engine with fellow developer Marc Norton. Previous to working at Sourcefire, Dan Roelker was a lead developer on the Dragon Network IDS at Enterasys Networks where he worked on application protocol decoders, high-speed packet capturing technology, event correlation (with Randy Taylor), and revamping the Dragon detection engine. Dan has also had fun working at the Johns Hopkins Applied Physics Lab in Information Operations for the DoD. He could tell you about it but then he'd have to kill you... His current security research is located at www.idsresearch.org, which is currently under construction but will be done by Defcon.